#pragma once
#include "../Base.h"
//========================================Struct===================================
typedef struct _LDR_DATA
{
	/*0x000*/     struct _LIST_ENTRY InLoadOrderLinks;
	/*0x010*/     struct _LIST_ENTRY InMemoryOrderLinks;
	/*0x020*/     struct _LIST_ENTRY InInitializationOrderLinks;
	/*0x030*/     VOID* DllBase;
	/*0x038*/     VOID* EntryPoint;
	/*0x040*/     ULONG32      SizeOfImage;
	/*0x044*/     UINT8        _PADDING0_[0x4];
	/*0x048*/     struct _UNICODE_STRING FullDllName;
	/*0x058*/     struct _UNICODE_STRING BaseDllName;
	/*0x068*/     ULONG32      Flags;
	/*0x06C*/     UINT16       LoadCount;
	/*0x06E*/     UINT16       TlsIndex;
	union
	{
		/*0x070*/         struct _LIST_ENTRY HashLinks;
		struct
		{
			/*0x070*/             VOID* SectionPointer;
			/*0x078*/             ULONG32      CheckSum;
			/*0x07C*/             UINT8        _PADDING1_[0x4];
		};
	};
	union
	{
		/*0x080*/         ULONG32      TimeDateStamp;
		/*0x080*/         VOID* LoadedImports;
	};
	/*0x088*/     struct _ACTIVATION_CONTEXT* EntryPointActivationContext;
	/*0x090*/     VOID* PatchInformation;
	/*0x098*/     struct _LIST_ENTRY ForwarderLinks;
	/*0x0A8*/     struct _LIST_ENTRY ServiceTagLinks;
	/*0x0B8*/     struct _LIST_ENTRY StaticLinks;
	/*0x0C8*/     VOID* ContextInformation;
	/*0x0D0*/     UINT64       OriginalBase;
	/*0x0D8*/     union _LARGE_INTEGER LoadTime;
}LDR_DATA, * PLDR_DATA;


typedef struct _OPERATION_INFO_ENTRY
{
	LIST_ENTRY    ListEntry;
	OB_OPERATION  Operation;
	ULONG         Flags;
	PVOID         Object;
	POBJECT_TYPE  ObjectType;
	ACCESS_MASK   AccessMask;
	ULONG32 time;
} OPERATION_INFO_ENTRY, * POPERATION_INFO_ENTRY;

typedef struct _CALL_BACK_INFO  //�ص���Ϣ�ṹ��
{
	ULONG64 Unknow;
	ULONG64 Unknow1;
	UNICODE_STRING AltitudeString; //�ص���������
	LIST_ENTRY NextEntryItemList; //(callbacklist) �����濪ͷ���Ǹ�һ�� �洢��һ��callbacklist
	ULONG64 Operations;
	PVOID ObHandle; //�洢��ϸ������ �汾�� POB_OPERATION_REGISTRATION AltitudeString Ҳ���Ǳ���ڵ�CALL_BACK_INFO ע��ʱҲʹ����� ע����ָ�� //CALL_BACK_INFO
	PVOID ObjectType;
	ULONG64 PreCallbackAddr;
	ULONG64 PostCallbackAddr;
}CALL_BACK_INFO, * PCALL_BACK_INFO;

typedef struct _OB_CALLBACK  //�ص��ṹ��
{
	LIST_ENTRY	ListEntry;
	ULONG64		Operations;
	PCALL_BACK_INFO		ObHandle; //�ص����
	ULONG64		ObjTypeAddr;
	ULONG64		PreCall; //ǰ�ù���
	ULONG64		PostCall;  //���ù���
} OB_CALLBACK, * POB_CALLBACK;



BOOLEAN GetVersionAndHardCode();
ULONG EnumObRegisterCallBacks();

//NTSTATUS AddSystemObjectCallBack();

//ע��ص�����
BOOLEAN ObRegisterCallBacksInit(PDRIVER_OBJECT pDriverObject);

//����ص�����
void ObRegisterUnload();

